Cyber Catalyst 2020 Risk Outlook - Top 5 Cyber Risks for 2020 - Marsh
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
INSIGHTS MARCH 2020 Cyber Catalyst 2020 Risk Outlook Top 5 Cyber Risks for 2020
INSIGHTS MARCH 2020 Cyber Catalyst 2020 Risk Outlook CONTENTS 3 Introduction 4 2019 Risk Landscape 6 Top 5 Risks for 2020 11 Solutions Sought in 2020 Program 12 Role of Cyber Catalyst Program 13 Cyber Catalyst 2020 — Leveraging Insurer Insights 14 Cyber Catalyst 2019 Designated Solutions 16 Cyber Catalyst Fact Sheet
Organizations are spending an ever
increasing amount on cybersecurity, with
the aim of reducing the impact of cyber
risk. That’s axiomatic in business: allocate
dollars to a critical problem, with the Cyber Catalyst – A Beacon
expectation it will yield results. of Clarity
In 2019, Marsh teamed with leading cyber insurers to create
Cyber CatalystSM, an innovative program designed to help
In the US, cybersecurity spending is clients and other organizations that are searching for significance
forecast to top $160 billion in 2020, a 60% in their cybersecurity choices. Cyber Catalyst by MarshSM
increase over 2014, and is estimated to provides organizations with clarity and actionable intelligence
they can use to make more informed decisions about which
reach $230 billion in 2025. But even as cybersecurity solutions to adopt. The program brings together
cybersecurity budgets soar, the economic eight cyber insurers to evaluate and identify cybersecurity
impact of cyber-crime is escalating. The solutions they believe can help reduce cyber risk. In the 2019
program, 17 cybersecurity products and services received the
global cost is now estimated at $1 trillion. ‘Cyber Catalyst’ designation.
The Need for a Different Approach Looking Back on 2019 and Ahead
Organizations are frustrated: they expect their cybersecurity to 2020
spending to deliver performance improvements similar to
those delivered by investment in other areas of enterprise risk. Following the program’s strong first year, we are taking a look
And business leaders increasingly recognize that investing in back at the most important cyber risks that insurers participating
technology alone is not sufficient, and that cybersecurity budgets in Cyber Catalyst saw in 2019 – not just the loss figures, but their
cannot continue to grow without limit. insights and experience from working with thousands of insureds.
When it comes to choosing how to allocate cybersecurity dollars, The insurers have also identified the top five cyber risks they
organizations are often equally challenged by the crowded and expect to see in 2020, and the types of solutions addressing those
complex cybersecurity market, with thousands of products and risks that they encourage vendors to submit for evaluation in Cyber
services on offer, all claiming to help manage cyber threats. Many Catalyst this year.
organizations lack the expertise or resources to identify which are
the most effective and appropriate for their needs. This connection is one of the key value drivers for the Cyber
Catalyst program: The insurance industry is helping organizations
to not only identify and respond to cyber risks, but also to take
proactive steps to adopt meaningful solutions and practices
that can improve their cybersecurity posture and reduce the
damage from cyber events. Cyber Catalyst does not aim to
replace other sources of cybersecurity evaluation or to signal
that technology alone is enough. Instead, it leverages the unique
insights of leading cyber insurers to deliver a new, important
perspective on how organizations can incorporate truly impactful
cybersecurity products and services into a comprehensive cyber
risk management program.
The 2020 Cyber Catalyst program opens for submission of eligible
products and services in March.
For more information, contact cybercatalyst@marsh.com or visit
www.marsh.com/cybercatalyst.com.
Marsh • 3
2019 Risk Landscape
Insurers participating in Cyber Catalyst identified the most notable Other major cyber risks seen by the Cyber Catalyst insurers in 2019
risks affecting their insureds and resulting in claims in 2019. include: social engineering, often in the form of business email
Chief among these were ransomware attacks, which increased compromise attacks which use phishing or other means to dupe
in frequency, severity, and breadth of victims. The evolution of users. Human error was identified as a consistent vulnerability,
ransomware was a particular concern: we’ve seen a shift from with insufficient policies, training, and employee awareness
relatively unsophisticated, low cost attacks, to highly sophisticated often opening the door to threats that technology alone could
attacks that target vulnerable organizations, exfiltrate or corrupt not prevent.
data, and demand payment of tens or even hundreds of millions of
dollars. Today’s ransomware has shifted well into the realm of the Outside of cyber-crime, privacy regulation was named as a small but
criminal economy. growing risk in 2019, with a few participating insurers citing claims
stemming from the Biometric Information Privacy Act (BIPA), and
Data breaches remained a significant risk in 2019, particularly most forecasting the emergence of wrongful data collection as a
costly “mega” breaches affecting millions of records. The 2020 looming risk for the year ahead.
Allianz Risk Barometer cites the average cost of managing a mega
breach at $42 million, up 8% over the previous year. Finally, a common theme cited by the insurers was that of system
and technology configuration errors, or misconfiguration of
Business interruption also ranked as a considerable and growing cybersecurity tools that leaves gaps for hackers to exploit. Faulty
risk, with claims and loss figures often lagging initial breach configuration was often cited in conjunction with cloud risk, but also
and ransomware claims due to the challenges of measuring and related to the incorrect or incomplete installation and integration of
documenting the incident’s operational and economic impact. controls and other technologies.
“One sophisticated ransomware attack on a global manufacturing client encrypted and prevented
access to multiple production lines and IT systems. We provided access to legal experts to advise on
regulatory obligations and technical advisors to bring systems back online and reverse engineer the
encryption keys, enabling full recovery. In addition to covering those costs, we advised the client to
increase incident response testing and implement bespoke back-up solutions for critical systems.”
— AXIS
“We saw a rise in business email compromise, especially in the US, where a single language and
large population create more attack surfaces and an easier environment for phishing or fraudulent
emails. We also saw a large amount of non-malicious incidents such as accidental disclosures and
misconfiguration.”
— BEAZLEY
“Topping the list of 2019 risks were business interruption events affecting clients in the large industrial
space. Whether the attacks impact factory lines or are distributed across IT or OT systems, the result is
downtime. Losses were not catastrophic as with NotPetya or WannaCry, but we helped many insureds
respond to BI attacks. It’s a concern that’s driving insurance uptake among large industrials.”
— MUNICH RE
“Ransomware and data breach were the leading cyber risks affecting our clients in 2019. We saw
significant increases in both the frequency of ransomware attacks and in the amounts demanded.
Equally troubling, ransomware attacks are often causing business interruption events as companies
incur income loss and extra expense to mitigate the attacks. Data breaches are still prevalent, as 2019
headlines showed, and financial exposures are rising as new privacy regulations come on line. Our
focus in 2019 and going forward is helping clients understand how cyber threats are evolving and build
cyber resilience.”
— MARSH
4 • Cyber Catalyst 2020 Risk Outlook
“The frequency and severity of ransomware claims spiked
tremendously: It was the number one loss event in terms of
ransom demands and level of forensics required. However, we
see many insureds responding to the threat by changing back-
up procedures. So claims that could easily have been $250,000
became $15,000 because of the defensive actions taken and work
International claims rose 13%
with our expert incident response vendor partners. We also saw
an increased number of claims for business email compromise,
in 2019. Top risks affecting
social engineering, and violations of BIPA.”
our clients: Data breaches
and technology/media liability
— AXA XL events.
— AXIS
“A few mega-breaches in 2019 will result in claims payouts
totaling tens of millions of dollars. The frequency of such
breaches has not increased, but they will likely continue to occur.
We saw ransomware events more than double in 2019, with
extortion demands averaging in excess of $300,000. And where
ransomware claims used to involve just extortion and forensics Beazley Ransomware
costs, the large majority now also involve business interruption Milestones 2018
claims, which can take six to seven months to resolve. Business •• Highest ransom demand reported:
Interruption proof of loss can be a challenging concept.”
$8.5 million
— SOMPO INTERNATIONAL
•• Highest ransom paid:
“In 2019, we saw many incidents among industry classes that $935,000
are not traditionally big purchasers of cyber insurance, such •• Average demand/payment:
as manufacturing and construction. Data breach risk has
historically driven cyber insurance buying, but events of the $116,324
past two years – NotPetya and others – have raised awareness *Beazley Breach Briefing 2019
about business interruption risk and the loss protection offered
by cyber insurance.”
— ZURICH NA
“One of the biggest risks we saw in 2019 was human error: It
continues to be a top vulnerability that requires constant training “Ransomware and social
and repetition. Training addresses human imperfection, and engineering comprised just
companies should take it seriously – it’s easy to implement. It’s over 60% of claims in 2019,
also a sign that the company is risk aware and usually more including a large increase
knowledgeable about their overall cyber risk program.” in ransomware attacks on
— ALLIANZ manufacturing and chemical
companies.”
“In the last year, the CFC cyber claims team handled more than — AXA XL Real-life cyber claims scenarios 2020
1,500 incidents and witnessed a sizeable jump in ransomware
and extortion events, nearly doubling in frequency between 2018
and 2019. What’s more, not only were these events much more
frequent, but they were also disproportionately expensive — even
though they accounted for 31% of our cyber claims in terms of
frequency, they accounted for 39% of what was paid out.”
— CFC UNDERWRITING
Marsh • 5
2020 Risk Outlook — Top 5 Risks
Cyber Catalyst participating insurers agreed on the top five cyber The insurers emphasize, however, that ransomware will continue
risks they expect to dominate the threat landscape in 2020. Some to morph in 2020, with attackers taking more risk and acting
are evolutions of those seen in 2019, exacerbated by an increasingly more strategically.
sophisticated and aggressive threat environment. Others derive
from heightened scrutiny or pressure on how organizations manage
their data practices, vendor relationships, and integration of new “Ransomware is now an industry where criminal
technology, and the vulnerabilities that are subsequently exposed. syndicates target companies using several attack
In each case, the risks are not static or wholly predictable but vectors. Companies that have not invested in endpoint
dynamic, and will continue to evolve throughout 2020 and beyond. protection or info security to an appropriate degree will
be at risk, whether small or large. Large firms that think,
‘we’re a manufacturer, no one wants our data’ are just as
Ransomware vulnerable as PII companies.”
— SOMPO INTERNATIONAL
Cyber Catalyst insurers said ransomware attacks will continue in
2020, given the relatively low entry hurdle for many hackers and “Threat actors will likely escalate the recent practice of
increasingly large sums demanded. exfiltrating data, then releasing ransomware into the
system environment, and threatening to publish data
Many of the conditions that have fostered the growth of on the internet. They’re now taking the data, not just
ransomware are expected to remain constant during 2020. freezing it.”
— AXA XL
“It’s logical to believe ransomware will continue in 2020,
because hackers find it profitable and many companies
have proved to be not as secure as they should be. Insurers “It’s a step-change in the ransomware ecosystem: Where
are likely to demand more security around ransomware, attacks were once mass distributed at random, now
and coverage is standard in most policies now.” attackers are analyzing the economic potential of where
the attack has penetrated and sell that information
— ALLIANZ
for criminals to exploit. We will see more targeting of
susceptible companies, and more foresight by attackers
“Businesses continue to be increasingly reliant on about the potential value of the target.”
technology and adopt more and more physical devices, so — MUNICH RE
there are an ever growing number of attack surfaces. In
addition, barriers to entry are limited, and ransomware is a
crime that is very difficult to police.” “Cybercriminals are getting savvier when it comes to
— AXIS ransomware. We expect the proliferation of Ransomware
as a Service (RaaS) to continue to drive frequency
and severity.”
“We’re seeing the commoditization of tools and knowledge
around ransomware, so the cost of entry is nearly zero, and — CFC UNDERWRITING
attacks on organizations without strong cyber security
defenses will likely continue or increase. Sophisticated
hackers are also increasingly targeting high value entities
with novel strains of ransomware that add a ‘doxing’ threat
of public exposure or shaming.”
— BEAZLEY
6 • Cyber Catalyst 2020 Risk Outlook
Privacy Regulation/
Data Collection
The California Consumer Privacy Act (CCPA) took effect January The CCPA, BIPA and GDPR are just the start of a growing global
1, 2020, and many subject organizations – for-profit entities that privacy regulatory movement, and several US states have similar
collect data of California residents – are still in the process of regulation pending. Given the increasingly stringent regulatory
understanding how it impacts them and the requirements for environment and expanded scope around non-breach events,
data collection and use. The CCPA contains provisions for privacy regulation and data collection are likely to be major sources
potentially significant legal damages as well as regulatory fines for of risk and potential insurance claims in 2020 and beyond.
non-compliance.
“CCPA is the great unknown. We don’t expect to see claims
As with the EU General Data Protection Regulation (GDPR) and
until enforcement begins in July, but as with BIPA claims in
BIPA, the scope of CCPA extends beyond incidents involving data
2019, wrongful data collection doesn’t require breach – it’s
breach, to business data practices. Legal action or regulatory
enforcement could be taken for wrongful data collection that does about enterprise data handling practices.”
not involve breach or data disclosure. — ALLIANZ
“With CCPA coming online, we expect an uptick in privacy “Most companies need help understanding how CCPA
events and claims around how companies collect and use will impact them and what resources and solutions are
data, even when the data is secure. Regulators, consumers, available. We’re out in front of that, with risk engineering
the plaintiffs’ bar, all have heightened expectations for services that help companies prepare to be regulatory
companies to be transparent about data collection, so ready and a policy that evolves with emerging cyber risk.”
there will be more claims opportunities. It’s not just
— ZURICH NA
about the perimeter – companies need to have and
enforce clear policies.”
“As the world moves to adopt stronger privacy regulation,
— MUNICH RE
customers and individuals are increasingly aware of their
rights, and businesses are challenged to keep pace with
“It’s a call for stronger data practices hygiene by all subject changing requirements around data handling practices.
companies. Based on 2019 requests from insureds trying to This is a potential recipe for further claims activity in the
understand whether they need to comply with BIPA, CCPA, privacy and data collection area.”
and GDPR and how to come into compliance, we expect
— AXIS
help with regulatory compliance will continue to be a big
ask by companies in 2020.”
— AXA XL “While we expect the CCPA to incite more interest in
cyber cover, much in the way that the GDPR did, it
is the burgeoning extraterritorial nature of privacy
“Now is the time for organizations to review their practices regulation that is going to make it harder for global firms
and ask: ‘We can and do collect this data, but should we? to navigate safely.”
Is the risk greater than the value?” — CFC UNDERWRITING
— BEAZLEY
Marsh • 7
Supply Chain/
Vendor Management
Organizations have long sought to streamline operations to focus
on core competencies and outsource non-core tasks to gain
competitive advantage. In an increasingly technology reliant,
interconnected business environment, this means granting access
to more vendors and devices across the digital supply chain. And
the number of vulnerabilities and attack surfaces grows in tandem
with growth of networked business partners and devices.
The risk extends beyond breach to business interruption, which
can have a material economic impact if production, inventory,
or distribution systems are paralyzed or incapacitated. The risk
posture of a company’s vendors and suppliers is as critical to its
security as its own defenses, as hackers are increasingly exploiting
the opportunity for multiple points of access to penetrate high
value targets.
“Cost savings is one of the key drivers of outsourcing
services to the supply chain, but it’s important not to do so
based on cost alone. Outsourcing to save money without
considering the full risk implications is likely to bring
additional risks.”
— BEAZLEY
“Hackers know it’s often easier to attack a target via its
vendor network than head-on: Why knock down the front
door when the window is easier? Businesses are starting to
recognize this and to consolidate the number of vendors,
but vendors who view themselves as low risk often have
cybersecurity postures that don’t measure up.”
— AXA XL
“Digital supply chains help companies get products out
more efficiently and quickly, but security needs to keep
pace. As businesses move from static servers to cloud to
digital third-party connections, it’s critical to bridge any
security gaps.”
— MUNICH RE
“Supply chain is a major exposure but it’s hard to evidence
controls. We are seeing business interruption events at
service providers resulting in losses to insureds. If your
vendor who you rely upon to conduct your business is
down, you’re at risk for loss.”
— SOMPO INTERNATIONAL
8 • Cyber Catalyst 2020 Risk Outlook
Cloud
Migration
More companies are moving to the cloud to decrease their use of “The moral of the cloud story is configuration. If you’re
costly on premise infrastructure or to maximize efficiencies, which configured poorly in your own network, it probably means
can bring an increase in – or increased recognition of – operational you won’t be correctly configured for cloud. It’s important
risk. Often it is the migration itself, and the effort to integrate cloud to not just check the box; how you implement and use
services with systems and data, that is the source of risk rather than the cloud is almost more important in terms of
the cloud itself. Most of the breach events seen by Cyber Catalyst
risk management.”
participating insurers can be ascribed to failure to correctly or
completely secure to the cloud environment, not the cloud itself. — SOMPO INTERNATIONAL
Common problems can include legacy servers, patching errors,
lack of encryption, unsecure S3 buckets, and difficulty managing an
abundance of technologies and digital assets. Cloud migration that
is executed without careful planning and expertise often creates “With the move to Office 365 and other cloud solutions,
new, unforeseen risk exposures. many organizations fail to realize that the protections put
in place 20 years ago don’t necessarily work effectively in
today’s working environments, which permit both remote
“Cloud integration is key: Infrastructure and access and the use of personal devices. Many times we
implementation is an issue ‘at the seams’ where discrete see organizations that have migrated to the cloud don’t
technology comes together at points of operation, and it’s use multi-factor authentication (MFA), or turn off MFA for
often the weakest point. Recognizing that vulnerability and executives – the very people who are targets.”
taking actions to address it is important.”
— BEAZLEY
— MUNICH RE
Marsh • 9
Social
Engineering
Social engineering attacks, already a notable risk in 2019, are Social engineering emails on the whole are increasingly cunning,
predicted to continue increasing in frequency, sophistication, with attackers sending emails from seemingly legitimate senders
and loss size in 2020. One of the most common forms of social that feature equally believable design and content to obtain
engineering seen by Cyber Catalyst insurers is business email credentials. They are also increasingly focused on fraudulent money
compromise: the use of compromised email credentials or a transfers, intercepting and altering emails regarding forthcoming
spoofed email address to trick employees into sharing sensitive payments so that funds are transferred to attackers instead of the
data or diverting invoice payments. rightful payee.
Business email compromise “Insurance markets have readily responded over the
worldwide losses since 2016: past few years to expand and add risks such as social
$26 billion. engineering under affirmative cyber coverages rather than
under other policies where the perils didn’t really belong.
— 2020 Allianz Risk Barometer
Social engineering used to be considered a crime coverage,
as was invoice manipulation.”
“Fraudulent invoice instructions are increasingly on the — AXA XL
rise. Often those emails are obviously fake, but people
tend to trust email beyond rational sense. Even quite
sophisticated organizations and employees often assume “Average cost of a business
that IT is checking and screening email traffic, and email compromise claim in 2018:
they trust email requests that they would not in any $70,960.”
other format.” — Beazley Breach Briefing 2019
— BEAZLEY
10 • Cyber Catalyst 2020 Risk OutlookCyber Catalyst 2020 –
Solutions Sought
Insurers participating in Cyber Catalyst identified a range of •• “Data protection services will be highly important for 2020,
cybersecurity solutions they believe will be important to help as regulators are ready and active in levying fines for existing
organizations address the five critical risks they expect during 2020. regulation and new ones like CCPA that are coming online. We’re
While the Cyber Catalyst 2020 program will accept for evaluation looking for solutions that are effective, regardless of the ultimate
all eligible cybersecurity products and services, participating outcome on insurability of fines.”
insurers are particularly keen to see solutions – ranging from “hard”
technology tools to “soft” services – that can help organizations •• “Capabilities that help with data management interpretation –
prevent, mitigate or manage risks in these areas: providing insight to help understand what’s going on internally
with an organization’s data, and visibility into broader global and
•• “Training programs: a good training program should be holistic regional trends. Continual risk assessment monitoring would
in approach and focus on securing the data, how you secure also be highly useful; not just a single point in time, but over
devices and computers, and where you store your data – not just time.”
the clicked link. That’s only the vector.”
•• “More tools for SMEs would be great – not every company can
•• “Wrongful data collection applies to the policies of the enterprise, afford big ticket security tools. Detection response tools or
not its cybersecurity controls. We’d like to see tools or services managed security service provider services would fill a
to help manage wrongful data collection, and to advise on real need.”
changing privacy regulations along with best practices for
•• “There is big demand for systems and services that automate
regulatory compliance.”
information security, both because companies want to reduce
•• “Services that can help insureds increase their regulatory headcount in that area, but also reflecting the dearth of skilled
awareness and assess their exposures in this area. Many private cybersecurity professionals. Demand far outpaces supply for
companies don’t see themselves as targets. A service that could those roles, and organizations who cannot attract the talent are
also help insureds adapt their data collection and handling likely willing to pay for the automated capability.”
policies to ensure full compliance would be particularly useful.”
•• “Solutions that are easy to configure and deploy. Products that
•• “Products that can help companies identify perimeter get these aspects right take a lot of the hard work away from the
weaknesses would be great: remote desk protocol (RDP) or user, which usually leads to better implementation and a more
Telnet exposed to the internet are often overlooked and lead satisfied and secure organization.”
to breaches, or organizations expose insecure protocols to
the internet without realizing it. A security scorecard would be
advantageous for 2020.”
•• “Services that address human risk. IT tools, firewalls, server
controls all are valuable, but staff education and training are
arguably of more value. We need solutions to help overcome the
psychological barrier that sees training as a mandatory checklist.
Compulsory training modules need to adapt to the modern
environment: Doable on the phone, at home, as a game, tied to
rewards, personalized, and relevant to real life situations. If you
can get employees motivated and fully engaged, then you’ve got
thousands of extra eyes and ears mitigating your organization’s
cyber risk profile.”
Marsh • 11Role of the Cyber Catalyst Program
Cyber Catalyst participating insurers believe the program plays an
important role in bridging the gap that frequently exists between
the realms of cyber insurance and cybersecurity, and in helping
organizations more confidently identify tools and products that are
effective in strengthening their cybersecurity posture.
The insurers also emphasized how the goals of Cyber Catalyst
dovetail with their own efforts to help insureds strengthen
cybersecurity programs and how meaningful solutions can inform
the risk underwriting process.
“Cyber Catalyst helps bring the insurance and
cybersecurity worlds together to create a common
viewpoint that helps the end user. Building cohesion
between insurers and cybersecurity providers can be
really valuable in terms of improving risk outcomes. Cyber
Catalyst delivers tangible value – it’s not an innovation
award or a rubber stamp, but a rigorous, meaningful
process that results in actionable information.”
“Cyber Catalyst helps bring transparency to the
— MUNICH RE
underwriting process, which is sometimes a hurdle for
potential buyers. It highlights factors that we underwriters
“In the midst of today’s cybersecurity ‘gold rush’, where look at in terms of how you protect your company and
there is a huge market with lots of players and options, it your ecosystem, and shows that we believe the use of
can be hard to identify the tools and providers that really effective technologies can help you better manage cyber
work or have proven expertise. Cyber Catalyst requires events. By identifying those technologies, Cyber Catalyst
candidates to demonstrate that their products solve delivers real value for companies that lack the resources to
actual problems. Like insurers’ vendor panels, Cyber do that on their own.”
Catalyst helps CISOs and others sort through the crowded — ZURICH NA
cybersecurity arena.”
— AXA XL “Cyber Catalyst reflects an evolution of how insurers
look at risk. Where traditionally insurance paid for losses
“As insurers, we have skin in the game, and we’re post-occurrence, we now also aim to proactively help our
accountable to our insureds. Cyber Catalyst puts us in the insureds strengthen risk postures and prevent loss at every
position of helping drive accountability of cybersecurity instance, across the risk continuum.”
providers and products on behalf of our insureds. — ALLIANZ
Cybersecurity should be a team sport: Cyber Catalyst
helps identify products that truly perform and vendors
interested in working as a team to address risk.” “Organizations want the best possible protection
against fast-evolving cyber threats, but many struggle to
— MUNICH RE
navigate the crowded cybersecurity marketplace. With
Cyber Catalyst, our clients and other organizations can
have greater confidence that they are implementing
cybersecurity tools that can have a meaningful impact on
reducing the cyber risks they face.”
— MARSH
12 • Cyber Catalyst 2020 Risk OutlookCyber Catalyst 2020 —
Leveraging Insights of Insurers
The Cyber Catalyst program adds the collective voice of leading Beyond paying losses, however, cyber insurers bring a wealth of
cyber insurers to the dialogue surrounding approaches to cyber knowledge and broad perspective on best practices that the Cyber
risk management, with the aim of helping improve overall cyber risk Catalyst program seeks to tap into for the benefit of organizations
management outcomes. seeking insight. These insurers also offer a host of value-added
services and resources that can help clients and other organizations
Cyber insurers have considerable experience and insight in the area not only respond and recover from cyber events, but better prepare
of cybersecurity and solutions that have a meaningful impact on for and mitigate the risk.
reducing cyber risk. The insurance industry has responded to the
costliest, most catastrophic cyber events of the past decade, paying “The interests of insurers are fully aligned with those of
hundreds of millions in cyber event losses annually. insureds: Reducing the cost and impact of risk. If we
can provide a service that will reduce your risk, if we can
“Insurers are focused on helping insureds improve their help you avoid spending money on a tool that isn’t really
cyber risk profile, not just reacting to risk. Services like effective, then we’ve delivered real value. We can see where
training and tabletop exercises, and advisory on security cybersecurity money is well spent and generating measurable
systems, access controls – that is all part of our broad risk ROI for our insureds. We are an ally of our insureds.”
management offering to clients.” — BEAZLEY
— ALLIANZ
“Insurers are uniquely positioned: We have both an intimate
view of our insureds’ exposures and security posture,
“Outside of law enforcement and the largest breach
and a 30,000-foot view of the global market that enables
response providers, insurers arguably have the most
us to identify trends in emerging risks, best practices,
first-hand knowledge of what breaches occur and what
cybersecurity providers and products, and response
they cost. We also play a pivotal role in our insureds’
mechanisms. Often the bespoke programs and unique
cyber practices: We incentivize the adoption of beneficial
solutions we create for large insureds become standard
behaviors and actions to strengthen cybersecurity. We
invest in credentialed cybersecurity professionals with options benefiting the broader marketplace.”
technical expertise to evaluate cybersecurity programs, — MUNICH RE
products and providers, and share that information with
“We can help companies quantify potential losses from cyber
our insureds.”
events and tie them directly to insurance limits. We know
— AXA XL where the cyber losses are coming from, and we’re able to
recommend certain controls that can help our insureds. And
“Insurers have the advantage of seeing many cybersecurity through our vendor panel, we give insureds access to the best
programs and gaining a really good feel for what’s vendors we know, and help them manage their costs.”
effective or not, and which technologies are being
— SOMPO INTERNATIONAL
effectively utilized. Larger insurers can bridge the
perception gap – to see the events that may not make the
“We have a macro perspective across our entire portfolio,
news but still impact businesses. That macro perspective
so we see how companies are affected by cyber events
of cybersecurity on a portfolio level is hard to find outside
like business interruption and reputation harm, not just
the insurance industry or large-scale tech services firms.” losses. We can offer best practice recommendation on risk
— AXIS prevention as well as response. With our risk assessment
reporting, we give risk managers the right vocabulary to
engage with other key stakeholders about ways to improve
response time, deploy resources more effectively, and
strengthen program maturity.”
— ZURICH NA
Marsh • 13Cyber Catalyst
Cyber Technology Evaluation Program
by
Marsh
Cyber Catalyst Designated Solutions 2019
Seventeen cybersecurity solutions received the Cyber CatalystSM designation in the
inaugural Cyber Catalyst by MarshSM program. Participating insurers identified these
products and services as being able to have a meaningful impact in reducing cyber risk.
Cyber CatalystSM 2019 Designated Cybersecurity Solutions
BigID Data Privacy Protection and
Aruba Policy Enforcement Firewall
Automated Compliance
CrowdStrike Adversary Emulation
Crowdstrike Falcon Complete™
Penetration Testing
Digital Guardian Data Protection Platform FireEye Email Security
Forescout Device Visibility and
FireEye Endpoint Security
Control Platform
HackerOne Bounty HPE Silicon Root of Trust
KnowBe4 Security Awareness Training and Mimecast Security Email Gateway with
Simulated Phishing Platform Targeted Threat Protection
Perspecta Labs SecureSmart™ critical
RSA SecurID® Access
infrastructure monitoring solution
Trustwave® DbProtect™ Virsec® Security Platform
Zingbox IoT Guardian™
14 • Cyber Catalyst 2020 Risk OutlookEvaluation Criteria
Insurers participating in Marsh’s Cyber Catalyst program evaluated The eight participating insurers voted independently on each
cybersecurity solutions that address major risks, including data solution, with Marsh tallying the votes and Microsoft serving as
breach, business interruption, data theft or corruption, and cyber technical advisor. Cyber Catalyst designation was awarded to
extortion. In evaluating these solutions, insurers used six criteria: products receiving positive votes by at least six insurers. Neither
Marsh nor Microsoft participated in the Cyber CatalystSM
1. Reduction of cyber risk: demonstrated ability to address major designation decisions.
enterprise cyber risk such as data breach, theft, or corruption;
business interruption; or cyber extortion. The next Cyber Catalyst program cycle is expected to launch
in 2020, when cybersecurity solutions can be submitted
2. Key performance metrics: demonstrated ability to quantitatively
for evaluation.
measure and report on factors that reduce the frequency or
severity of cyber events.
3. Viability: client-use cases and successful implementation. Insurance Policies and
4. Efficiency: demonstrated ability of users to successfully Implementation Principles
implement and govern the use of the product to reduce
Organizations that adopt Cyber Catalyst-designated solutions may
cyber risk.
be considered for enhanced terms and conditions on individually
5. Flexibility: broad applicability to a range of companies negotiated cyber insurance policies with participating insurers.
and industries. Marsh has worked with each participating insurer to establish
endorsement wordings that reflect the coverage enhancements
6. Differentiation: Distinguishing features and characteristics. that those insurers might offer to Marsh clients which adopt one or
more Cyber Catalyst designated solution.
Evaluation and Designation Process When considering potential policy enhancements, those insurers
will expect organizations to implement the Cyber Catalyst
The platform for vendors to submit cybersecurity solutions for
designated products or services in a certain manner. To that end,
evaluation was open from March 26 through May 5, 2019. Eligibility
participating insurers worked with the vendors whose solutions are
criteria required that the cybersecurity products or services be
Cyber Catalyst designated to develop “implementation principles”
1) currently available in the United States and 2) deployed in an
for each product or service.
enterprise environment. The evaluation process included a deep
dive into eligible products and services that participating insurers
felt merited review, and demonstrations to those insurers. Contact Marsh at cyber.risk@marsh.com to learn more.
CL ARIT Y IN A CROWDED CYBERSECURIT Y MARKET
Cyber Catalyst by MarshSM brings together leading cyber insurers, with technical advice from Microsoft, to evaluate and identify
cybersecurity solutions they consider effective in reducing cyber risk. Cyber Catalyst is designed to help organizations make
more informed choices about cybersecurity products and services to manage their risk. It provides organizations with greater
clarity and confidence in an increasingly complex cybersecurity marketplace, as well as an understanding of which cybersecurity
solutions most matter to insurers.
Cyber Catalyst • 15Cyber Catalyst: Sparking Change
in Cyber Risk Management
Cyber Catalyst by MarshSM is a first-of-its-kind program designed to help organizations
make more informed choices about cybersecurity products and services to manage
their cyber risk. Through Cyber CatalystSM, Marsh brings together leading insurers to
identify cybersecurity solutions they consider effective at reducing cyber risk — giving
organizations greater clarity and confidence in an increasingly complex cybersecurity
marketplace.
The Cyber Catalyst by MarshSM program provides organizations
with a clearer understanding of which cybersecurity solutions
Challenges of Navigating the
matter to cyber insurers. Participating insurers include Cybersecurity Market
Allianz; AXA XL, a division of AXA; AXIS; Beazley; CFC; Munich
Organizations want the best possible protection against fast-
Re; Sompo International; and Zurich North America, which
evolving cyber threats, but often struggle to optimize the
collectively represent a substantial portion of gross written
impact of their cybersecurity investments. Even as corporate
premiums in the $5 billion global cyber insurance market. The
cybersecurity budgets grow, the economic impact of cyber
insurers’ evaluation focuses on better equipping organizations
events continues to climb. The annual cost of cybercrime is
to select cybersecurity solutions that can have a meaningful
estimated at $1 trillion globally, and is rising every year. Although
impact on cyber risk.
companies want to see meaningful risk reduction results from
their cyber dollar, many are challenged to identify the most
effective solutions.
16 • Cyber Catalyst 2020 Risk OutlookThat’s because the cybersecurity market can be crowded, complex,
and difficult to navigate. Global spending on cybersecurity is
Vendor Application Information
expected to top $150 billion in 2020. Thousands of cybersecurity Any cybersecurity vendor who meets eligibility criteria is
firms offer products, services, and solutions designed to mitigate invited to submit their product or service for evaluation in the
and combat cyber risk, but it can be challenging for individual Cyber Catalyst SM program, provided the product or service is
organizations to evaluate those offerings given limited corporate offered in the United States.
resources and expertise.
The application period for cybersecurity vendors to submit
products and services for evaluation in the 2020 Cyber Catalyst
Cyber Insurers Have program is March 10th through 27th.
Valuable Insights to Offer
Cyber insurers have responded to the most catastrophic and costly Marsh Cyber Risk Practice
cyber events of the past decade. They also have considerable
experience and insight gained from their engagement with a wide
range of cybersecurity vendors and products. This experience
means cyber insurers are well-positioned to provide informed
views on the potential effectiveness of cybersecurity solutions in
reducing cyber risk.
SM
How Cyber Catalyst Works
The Cyber Catalyst SM program was created by Marsh to help
address questions we often hear from clients: “What cybersecurity For more information on the Cyber CatalystSM program or vendor
solutions should we implement?” “What cybersecurity products eligibility and evaluation criteria, visit marsh.com/cybercatalyst,
does our insurer value most from a risk underwriting perspective?” email us at CyberCatalyst@marsh.com,or contact:
THOMAS REAGAN
In Cyber Catalyst SM:
Cyber Practice Leader
Marsh
•• Cybersecurity vendors submit their eligible products and +1 212 345 9452
services for consideration and evaluation. thomas.reagan@marsh.com
•• Participating insurers evaluate cybersecurity offerings and marsh.com/cybercatalyst
identify those they believe can have a meaningful impact on
major cyber risks, such as data breaches, business interruption,
data theft or corruption, and cyber extortion.
•• Marsh facilitates but does not contribute to the decision-making
process or evaluation of cybersecurity solutions.
•• Products and services considered by participating insurers
to be effective at reducing cyber risk are designated
as “Cyber Catalyst SM”.
•• Organizations that adopt Cyber Catalyst SM –designated products
and services may qualify for enhanced terms and conditions
on individually negotiated cyber insurance policies offered by
participating insurers.
Cyber Catalyst • 17Cyber Catalyst by MarshSM
Leading insurers participating in the 2020 Cyber Catalyst program collectively represent a
substantial portion of the $5 billion global insurance market. They are:
Marsh is a global leader in insurance broking and innovative The 2020 Cyber Catalyst program will be open for submission
risk management solutions, and a leading broker of cyber of eligible products and services March 10-27, 2020. Cyber
insurance. Marsh’s global cyber risk management practice Catalyst product designations are expected to be announced
places more than $1 billion in premiums annually for more than in September.
6,300 clients worldwide.
For more information, contact cybercatalyst@marsh.com or visit www.marsh.com/cybercatalyst.com.
18 • Cyber Catalyst 2020 Risk OutlookMarsh Cyber Practice By the Numbers Marsh is one of the Marsh & McLennan Companies, together with Guy Carpenter, Mercer, and Oliver Wyman. This document and any recommendations, analysis, or advice provided by Marsh (collectively, the “Marsh Analysis”) are not intended to be taken as advice regarding any individual situation and should not be relied upon as such. The information contained herein is based on sources we believe reliable, but we make no representation or warranty as to its accuracy. Marsh shall have no obligation to update the Marsh Analysis and shall have no liability to you or any other party arising out of this publication or any matter contained herein. Any statements concerning actuarial, tax, accounting, or legal matters are based solely on our experience as insurance brokers and risk consultants and are not to be relied upon as actuarial, tax, accounting, or legal advice, for which you should consult your own professional advisors. Any modeling, analytics, or projections are subject to inherent uncertainty, and the Marsh Analysis could be materially affected if any underlying assumptions, conditions, information, or factors are inaccurate or incomplete or should change. Marsh makes no representation or warranty concerning the application of policy wording or the financial condition or solvency of insurers or reinsurers. Marsh makes no assurances regarding the availability, cost, or terms of insurance coverage. Although Marsh may provide advice and recommendations, all decisions regarding the amount, type or terms of coverage are the ultimate responsibility of the insurance purchaser, who must decide on the specific coverage that is appropriate to its particular circumstances and financial position. Copyright © 2020 Marsh LLC. All rights reserved. MAXX-XXXXXX 472455865
You can also read
